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In the claims : 

Please amend the claims as follows: 



Claim 1 (currently amended): A method for securing an accessible computer system, the 
method comprising: 

monitoring a computer system for connection transactions between multiple at least on e 
access requ e sto r req uestors and multiple at least on e access provid e r providers using a switching 
component connected to the multiple access providers ; and 

denying access by an attackingt he access requestor to the access provid e r providers when 
a number of connection transactions initiated by the attacking access requestor through the 
switching component exceeds a configurable threshold number during a first configurable period 
of time. 



Claim 2 (currently amended): The method as in claim 1, wherein the monitoring includes 
detecting connection transactions initiated by the access r e qu e sto rr equestors through the 
switching component . 

Claim 3 (currently amended): The method as in claim 2, wherein the monitoring further 
includes counting the number of connection transactions initiated by the access 
requesto rr equestors through the switching component during the first configurable period of 
time. 



Claim 4 (currently amended): The method as in claim 3, wherein the monitoring further 
includes comparing the number of connection transactions initiated by the access 
r e qu e sto r requestors through the swithing component during the first configurable period of time 
to the configurable threshold number. 

Claim 5 (currently amended): The method as in claim 1, wherein the monitoring includes 
detecting connection transactions between multiple at lea s t one Internet protocol 
address addresses and the access provid e r providers with the switching component . 
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Claim 6 (currently amended): The method as in claim 5, wherein the monitoring further 
includes counting the number of connection transactions initiated through the swi thing 
component by the Internet protocol address addresses during the first configurable period of time. 

Claim 7 (currently amended): The method as in claim 6, wherein the monitoring further 
includes comparing the number of connection transactions initiated by the Internet protocol 
address addresses through the switching component during the first configurable period of time to 
the configurable threshold number. 

Claim 8 (original): The method as in claim 6, wherein the monitoring includes 
monitoring a computer system for connection transactions made using TCP. 

Claim 9 (currently amended): The method as in claim 5, wherein the detecting includes 
identifying the Internet protocol address addresses through the use of a header attached to a 
message representing the connection transaction being detected. 

Claim 10 (currently amended): The method as in claim 1, wherein the denying of access 
includes denying access to the access provide r providers through the switching component by the 
attacking access requestor for a second configurable period of time. 

Claim 1 1 (currently amended): The method as in claim 10, wherein the denying of 
access further includes resetting the second configurable period of time after detecting a new 
connection transaction initiated by the attacking access requestor through the switching 
component during the second configurable period of time. 

Claim 12 (currently amended): The method as in claim 1, wherein the denying of access 
includes denying access to the access provide r providers through the switching component by the 
attacking access requestor for a second configurable period of time after detecting a most recent 
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connection transaction initiated by the attacking access requesto r through the switching 
component . 

Claim 13 (currently amended): The method as in claim 1, wherein the access 
r e qu e sto r requestors areis-a efe rtclients and the access provid e r providers areis-a hest hosts such 
that the monitoring includes detecting connection transactions through the switching component 
between multiple at l e ast on e etiea telients and multiple at l e ast on e hest hosts . 

Claim 14 (currently amended): The method as in claim 34-, wherein the counting further 
comprises counting a cumulative number of connection transactions for the multiple access 
providers connected to the switching component initiated by each of the access req uestors during 
the first configurable period of time. access requ e stor is a cli e nt and the access provider is a host 
such that th e monitoring includ e s d e tecting conn e ction transactions between th e acc e ss r e qu e stor 
and a plurality of access providers. 

Claim 15 (currently amended): A system for securing an accessible computer system, 
comprising: 

means for a switching component connected to multiple access providers to: 
monitoring a computer system for connection transactions between multiple at l e ast on e 

access requesto r requestors and the multiple at l e ast one access provid e r providers ; and 
m e ans for denying access by an attacking the access requestor to the access 

provide r providers when a number of connection transactions initiated by the attacking access 

requestor exeeed exceeds a configurable threshold number during a first configurable period of 

time. 

Claim 16 (currently amended): The system of claim 15, wherein the means for 
monitoring the switching component includes: 

means for detecting connection transactions initiated by the access requesto r requestors 
through the switching component ; 
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means for counting the number of connection transactions initiated by the access 
requ e sto r requestors through the switching component during the first configurable period of 
time; and 

means for comparing the number of connection transactions initiated by the access 
requ e sto r requestors through the switching component during the first configurable period of time 
to the configurable threshold number. 

Claim 17 (currently amended): The system of claim 15, wherein the means for 
monitoring the switching component includes: 

means for detecting connection transactions between multiple at least one Internet 
protocol address addresses and the access provid e r providers using the switching component ; 

means for counting the number of connection transactions initiated by the Internet 
protocol address addresses through the switching component during the first configurable period 
of time; and 

means for comparing the number of connection transactions initiated by the Internet 
protocol address addresses through the switching component during the first configurable period 
of time to the configurable threshold number. 

Claim 18 (original): The system of claim 17, wherein the means for monitoring includes 
means for monitoring a computer system for connection transactions made using TCP. 

Claim 19 (currently amended): The system of claim 17, wherein the means for detecting 
includes: 

means for identifying the Internet protocol address addresses through the use of a header 
attached to a message representing the connection transaction being detected. 

Claim 20 (currently amended): The system of claim 15, wherein the means for d e nying 
aeeess the switching component includes: 

means for denying access to the access provid e r providers through the switching 
component by the attacking access requestor for a second configurable period of time. 
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Claim 21 (currently amended): The system of claim 20, wherein the means for denying 
access further includes: 

means for resetting the second configurable period of time after detecting a new 
connection transaction initiated by the attacking access requestor through the switching 
component during the second configurable period of time. 

Claim 22 (currently amended): The system of claim 15, wherein the means for denying 
aeeess the switching component includes: 

means for denying access to the access provid e rp roviders through the switching 
component by the attacking access requestor for a second configurable period of time after 
detecting a most recent connection transaction initiated by the access requestor. 

Claim 23 (currently amended): The system of claim 15, wherein the access 
requ e sto r requestors areis-a etieat clients and the access provid e r providers areis-a hesthosts such 
that the means for monitorin g the switching component includes: 

means for detecting connection transactions through the switching component between 
multipel at least one elieft tolients and multiple at least one hesthosts. 

Claim 24 (currently amended): The system of claim 4516, wherein the means for 
counting further comprises means for counting a cumulative number of connection transactions 
for the multiple access providers connected to the switching component initiated by each of the 
access requestors during the first configurable period of time. acc e s s r e qu e stor is a cli e nt and th e 
access provider is a host such that th e means for monitoring includes: 

means for d e t e cting conn e ction transactions b e twe e n th e acc e ss requ e stor and a 

plurality of acc e ss provid e rs. 

Claim 25 (currently amended): A system for securing an accessible computer system, 
comprising: 

a switching component connected to multiple access providers to: 
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a monitoring compon e nt that is structur e d and arrang e d to monitor a computer 
system for connection transactions between multiple at l e ast on e access requesto r requestors and 
multiple at l e ast one access provid e r providers ; and 

a blocking component that is structured and arranged to deny access by the access 
requestor to the access pro vid e r providers when a number of connection transactions initiated by 
an attacking the access requestor exceed a configurable threshold number during a first 
configurable period of time. 



Claim 26 (currently amended): The system of claim 25, wherein the 
monitorin g switching component comprises: 

a detection component that is structured and arranged to detect connection transactions 
initiated by the access r e questo r requestors through the switching component ; 

a counting component that is structured and arranged to count the number of connection 
transactions initiated by the access requesto r requestors through the switching component during 
the first configurable period of time; and 

a comparing component that is structured and arranged to compare the number of 
connection transactions initiated by the access r e qu e Gto r requestors through the switching 
component during the first configurable period of time to the configurable threshold number. 

Claim 27 (currently amended): The system of claim 25, wherein the 
moni torin g s wi tching component comprises: 

a detection component that is structured and arranged to detect connection transactions 
through the switching component between multip le at l e a s t one Internet protocol 
addfes saddresses and the access provide r providers ; 

a counting component that is structured and arranged to count the number of connection 
transactions initiated through the switching component by the Internet protocol address addresses 
during the first configurable period of time; and 

a comparing component that is structured and arranged to compare the number of 
connection transactions initiated through the switching component b y the Internet protocol 
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address addresses during the first configurable period of time to the configurable threshold 
number. 

Claim 28 (original): The system of claim 27, wherein the connection transactions include 
connections made using TCP. 

Claim 29 (currently amended): The system of claim 27, wherein the detection 
component comprises: 

an identifying component that is structured and arranged to identify the Internet protocol 
addres s addresses through the use of a header attached to a message representing the connection 
transaction being detected. 

Claim 30 (currently amended): The system of claim 25, wherein the blockin g switching 
component comprises: 

an access preventer that is structured and arranged to deny access to the access 
provider p roviders through the switching component by the attacking access requestor for a 
second configurable period of time. 

Claim 31 (currently amended): The system of claim 30, wherein the blockin g switching 
component further comprises: 

a timing component that is structured and arranged to measure the second configurable 
period of time during which the access preventer denies access to the access provide r providers 
by the attacking access requestor. 

Claim 32 (currently amended): The system of claim 31, wherein the blockin g switching 
component further comprises: 

a reset component that is structured and arranged to reset the timing component after 
detecting a new connection transaction initiated by the attacking access requestor through the 
switching component during the second configurable period of time. 
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Claim 33 (currently amended): The system of claim 25, wherein the blockin g switching 
component comprises: 

an access preventer that is structured and arranged to deny access to the access 
provide r providers through the switching component by the attacking access requestor for a 
second configurable period of time after detecting a most recent connection transaction initiated 
by the access requestor. 

Claim 34 (currently amended): The system of claim 25, wherein the access 
r e qu e sto rr equestors are4 s-a eben tclients and the access provid e r providers are4 s~a best hosts such 
that the monitorin g switching component comprises: 

a detection component that is structured and arranged to detect connection transactions 
through the switching component between multiple at l e a s t on e ebent clients and multiple a ^east 
em hest hosts . 

Claim 35 (currently amended): The system of claim 2S26, wherein the counting 
component further comprises counting a cumulative number of connection transactions for the 
multiple access providers connected to the switching component initiated by each of the access 
requestors during the first configurable period of time. acc e ss requestor is a cli e nt and the access 
provider is a host such that the monitoring component compris e s: 



transactions betwe e n th e acc e ss r e qu e stor and a plurality of acc e ss provid e rs. 

Claim 36 (currently amended): The system of claim 25, wherein th e monitoring 
component and the blocking component are included in a host computer system tha^receives 
communications from athe switch ing component . 



a detection component that is structured and arranged to d e tect connection 



Claim 37 (currently amended): The system of claim 25, wherein the monitoring 
component and the blockin g switching component afeis included in a switch that receives 
communications from a host computer system. 



